CVE-2026-22260CWE-674

Suricata http1: infinite recursion in decompression

High · published January 27, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

⚡ A sneaky stack overflow is causing Suricata to crash in versions 8.0.0 to 8.0.2! 🚨 Think of Suricata like a busy restaurant kitchen. If too many orders (data packets) flood in all at once, the chef (the system) starts dropping dishes (crashing) because it can’t handle the chaos. This stack overflow is like the kitchen getting overwhelmed, leading to a big mess! When this stack overflow occurs, Suricata crashes, leaving your network unprotected and vulnerable. An attacker could exploit this to bypass your defenses, leading to potentially devastating data breaches or further attacks on your infrastructure. Imagine your vigilant security guard taking a nap while threats slip past!

Put simply

Think of Suricata like a busy restaurant kitchen. If too many orders (data packets) flood in all at once, the chef (the system) starts dropping dishes (crashing) because it can’t handle the chaos. This stack overflow is like the kitchen getting overwhelmed, leading to a big mess! This vulnerability arises from a stack overflow issue where Suricata cannot manage excessive request and response sizes, leading to an application crash. It affects versions 8.0.0 to 8.0.2, and the issue has been patched in version 8.0.3.

What to do

When this stack overflow occurs, Suricata crashes, leaving your network unprotected and vulnerable. An attacker could exploit this to bypass your defenses, leading to potentially devastating data breaches or further attacks on your infrastructure. Imagine your vigilant security guard taking a nap while threats slip past! To secure your system, upgrade Suricata to version 8.0.3 immediately. As a temporary workaround, set the `request-body-limit` and `response-body-limit` to their default values to minimize the risk while you plan your upgrade. Don't leave your network in the lurch! You've got this! With these steps, you’ll have Suricata back on its feet and guarding your network like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00561 · 45.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-01-27T17:30Z
EPSS history
Timeline
  • 27 JAN 17:30Z
    Suricata http1: infinite recursion in decompression
    cvelistv5